Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


I think I have CryptoWall Virus

  • This topic is locked This topic is locked
6 replies to this topic

#1 krbam2


  • Members
  • 4 posts
  • Gender:Female
  • Local time:11:24 AM

Posted 23 June 2014 - 09:51 PM

I performed an Internet search using IE9 on google for Firefox. When I clicked on the link that said download Firefox  - Free Web Browser - Mozilla, I was apparently redirected to another website insterad of Mozilla.org. I didn't catch it because it had the Firefox logo. My first indication something was wrong was when I ran the install it gave me the option to install three other programs, I chose Custom install and unchecked the add ons.Once the install ran - I found the add-ons had installed anyway. I didn't realize this hadn't been done on purpose until the same thing happened when I tried to download MalwareBytes. I got the same installer (something called a Fusion file) and an offer to install the same 3 add on files. I cancelled this install and went to programs and uninstalled the three programs.  I found the install filed downloaded had incorrect names. The Firefox download file was called Firefox-Setup instead of Firefox Setup Stub 30.0 and the Malwarebytes download was called MalwareBytes-Setup instead of mbam-setup- After uninstalling the 3 programs I was able to download the correct MalwareBytes and install it. I ran it and it found 24 infected files - it also triggered my Mcafee to pop up saying I had a trojan. I removed the items using Malwarebytes and when I rebooted I was  left at a website that had nothing to do with Malwarebytes.


I also had a text file popup with this information....



What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048 using CryptoWall.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)

What does this mean ?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them,
it is the same thing as losing them forever, but with our help, you can restore them.

How did this happen ?
Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.
All your files were encrypted with the public key, which has been transferred to your computer via the Internet.
Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.

What do I do ?
Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.
If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.

For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:

If for some reasons the addresses are not available, follow these steps:
1.Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2.After a successful installation, run the browser and wait for initialization.
3.Type in the address bar: kpai7ycr7jxqkilp.onion/9k5b
4.Follow the instructions on the site.

Your personal page: https://kpai7ycr7jxqkilp.enter2tor.com/9k5b
Your personal page (using TOR): kpai7ycr7jxqkilp.onion/9k5b
Your personal identification number (if you open the site (or TOR 's) directly): 9k5b


This lead me to a web search and I found other entried for this topic on this site. So here I am.

I have found that all my personal files are apparently encrypted (pictures, spreadsheets, cannot open Outlook because my pst file is invalid)


I ran DDS.com as instructed and here is dds.txt


DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16421
Run by Kim at 21:31:06 on 2014-06-23
Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.3982.2088 [GMT -5:00]
AV: McAfee VirusScan Enterprise *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
============== Running Processes ===============
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\windows\System32\svchost.exe -k HPZ12
C:\windows\System32\svchost.exe -k HPZ12
C:\windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\mfeann.exe
C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
C:\Users\Kim\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
C:\Program Files (x86)\Google\Update\\GoogleCrashHandler.exe
C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe
C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
C:\Program Files (x86)\AirPort\APAgent.exe
C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
C:\Program Files (x86)\Google\Update\\GoogleCrashHandler64.exe
C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe
C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
C:\Program Files (x86)\Browny02\BrYNSvc.exe
C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
C:\Program Files (x86)\McAfee\Common Framework\McTray.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.elections.il.gov/
mWinlogon: Userinit = userinit.exe
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20121028080938.dll
mRun: [McAfeeUpdaterUI] "C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
mRun: [ShStatEXE] "C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [AirPort Base Station Agent] "C:\Program Files (x86)\AirPort\APAgent.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [ControlCenter4] C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun
mRun: [BrStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
mRun: [BrHelp] C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe /AUTORUN
StartupFolder: C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.HTML
StartupFolder: C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.TXT
StartupFolder: C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.URL
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\NETGEA~1.LNK - C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
TCP: NameServer =
TCP: Interfaces\{670A4685-ECAF-43ED-BEA9-81C4FDE04F1E} : DHCPNameServer =
TCP: Interfaces\{AD54ED70-C2F0-44F8-91CD-0F2AA7DAC22D} : DHCPNameServer =
SSODL: WebCheck - <orphaned>
x64-BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20121028080938.dll
x64-Run: [IgfxTray] C:\windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\windows\System32\igfxpers.exe
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
============= SERVICES / DRIVERS ===============
R0 mfehidk;McAfee Inc. mfehidk;C:\windows\System32\drivers\mfehidk.sys [2012-10-28 642952]
R0 mfewfpk;McAfee Inc. mfewfpk;C:\windows\System32\drivers\mfewfpk.sys [2012-10-28 283744]
R0 SCMNdisP;General NDIS Protocol Driver;C:\windows\System32\drivers\SCMNdisP.sys [2013-2-2 25056]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2013-6-28 14624]
R2 McAfeeFramework;McAfee Framework Service;C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [2011-1-12 120128]
R2 McShield;McAfee McShield;C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe [2012-10-28 199008]
R2 McTaskManager;McAfee Task Manager;C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe [2011-9-14 209760]
R2 mfevtp;McAfee Validation Trust Protection Service;C:\windows\System32\mfevtps.exe [2012-10-28 158832]
R2 WSWNA3100;WSWNA3100;C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe [2014-5-10 307928]
R3 BCMH43XX;Broadcom 802.11 USB Network Adapter Driver;C:\windows\System32\drivers\bcmwlhigh664.sys [2013-2-2 1256192]
R3 BrSerIb;Brother Serial Interface Driver(WDM);C:\windows\System32\drivers\BrSerIb.sys [2014-3-29 95344]
R3 BrUsbSIb;Brother Serial USB Driver(WDM);C:\windows\System32\drivers\BrUsbSib.sys [2014-3-29 21872]
R3 BrYNSvc;BrYNSvc;C:\Program Files (x86)\Browny02\BrYNSvc.exe [2014-3-29 282112]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\windows\System32\drivers\mfeavfk.sys [2012-10-28 228752]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2012-4-11 676968]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 mferkdet;McAfee Inc. mferkdet;C:\windows\System32\drivers\mferkdet.sys [2012-10-28 100904]
S3 StorSvc;Storage Service;C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
S4 HP Support Assistant Service;HP Support Assistant Service;"C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" --> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [?]
=============== Created Last 30 ================
2014-06-24 00:14:07 -------- d-----w- C:\ProgramData\IdaviCfice
2014-06-23 23:30:43 -------- d-----w- C:\QUARANTINE
2014-06-23 22:57:06 -------- d-----w- C:\Users\Kim\AppData\Local\Mozilla
2014-06-23 22:56:46 20080 ----a-w- C:\Program Files (x86)\Mozilla Firefox\AccessibleMarshal.dll
2014-06-23 22:56:46 10594416 ----a-w- C:\Program Files (x86)\Mozilla Firefox\icudt52.dll
2014-06-23 22:56:27 -------- d-----w- C:\Users\Kim\AppData\Roaming\Malwarebytes
2014-06-23 22:55:58 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-06-23 22:52:48 25928 ----a-w- C:\windows\System32\drivers\mbam.sys
2014-06-23 22:52:48 -------- d-----w- C:\ProgramData\Malwarebytes
2014-06-23 22:52:48 -------- d-----w- C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-23 22:52:33 -------- d-----w- C:\Users\Kim\AppData\Local\Programs
2014-06-23 22:25:18 -------- d-----w- C:\temp
2014-06-23 22:24:49 -------- d-----w- C:\Program Files\003
2014-06-23 22:23:27 -------- d-----w- C:\Program Files\pcmax
2014-06-23 22:23:22 -------- d-----w- C:\Program Files (x86)\PC Speed Maximizer
2014-06-23 22:14:22 -------- d-----w- C:\Users\Kim\AppData\Local\Udtmedia
==================== Find3M  ====================
============= FINISH: 21:31:38.14 ===============



Attached is the Attach.zip

Attached Files

BC AdBot (Login to Remove)


#2 krbam2

  • Topic Starter

  • Members
  • 4 posts
  • Gender:Female
  • Local time:11:24 AM

Posted 24 June 2014 - 10:00 AM

I need to post more information. I think I have determined where I obtained the virus - I went to a site called www.thecombineforum.com looking for a checklist. On the site I got a message that my java was out of date. Even though I clicked block javascript on this site, something ran. I ended up with an entry in my user startup - the file was called msident.dll (an actuall microsoft file name) but was located in my local profile.  The folder name was udtmedia on one computer and agngworks on another (yes I managed to do it again. :-) ) I believe this file caused my re-direct problem that sent me to the bogus download sites for Firefox and MalwareBytes. Once I downloaded and installed I was hosed.


On a better note...I have found that I can restore my files to a previous version and the problem with inaccessibility due to encryption is gone. So I no longer need help cleaning my computer AND I didn't have to pay a ransom. Gonna restore files to previous and save on DVD then re-install my computer.


I guess I should ask - is there any way to report this anywhere that might get the hackers stopped (or terminated :-) ) ? This seems to be fairly new.

#3 nasdaq


  • Malware Response Team
  • 40,540 posts
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:24 AM

Posted 28 June 2014 - 08:16 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.

Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Click the Report button and the report will open in Notepad.
  • If you click the Clean button all items listed in the report will be removed.
If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Check off the element(s) you wish to keep.
  • Click on the Clean button follow the prompts.
  • A log file will automatically open after the scan has finished.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).

Download the correct version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.


Please paste the logs in your next reply DO NOT ATTACH THEM unless specified.
To attach a file select the "More Reply Option" and follow the instructions.

Let me know what problem persists.

#4 krbam2

  • Topic Starter

  • Members
  • 4 posts
  • Gender:Female
  • Local time:11:24 AM

Posted 29 June 2014 - 11:14 AM


sorry for the confusion. if you read my second post you will see I figured out how to get my files back and I have since re-installed my computer just to be safe. I posted what I did so maybe others could use the same thing to get their files.

#5 nasdaq


  • Malware Response Team
  • 40,540 posts
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:24 AM

Posted 29 June 2014 - 01:04 PM

Yes I know.

If you still want me to check what you now have that may need to be removed please run the tools I suggrested.

Otherwise good luck.

#6 krbam2

  • Topic Starter

  • Members
  • 4 posts
  • Gender:Female
  • Local time:11:24 AM

Posted 29 June 2014 - 01:25 PM

Thanks again. This topic can be closed.

#7 nasdaq


  • Malware Response Team
  • 40,540 posts
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:24 AM

Posted 30 June 2014 - 06:37 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users